LINUX.ORG.RU
Форум — Admin  

OpenVPN

 ,


0

1

Здравствуйте, у меня работает OpenVPN сервер, я решил продублировать на другом сервере, просто поднял на голой системе OpenVPN скопировал все ключи, настройки, iptables аналогично как на первом серве (поменяв ip адреса само собой). В итоге по новому ip подключается но трафифик не идёт, даже локальная сеть (10.0.0.1) не пингуется.

Это всё прописано:

net.ipv4.ip_forward=1

iptables -t nat -A POSTROUTING -s 10.0.0.0/24 -o $IFACE -j MASQUERADE

При подключении клиента вот такой лог

2026-03-25T10:30:25.051550+00:00 136309 ovpn-server[827]: Connection Attempt MULTI: multi_create_instance called
2026-03-25T10:30:25.051985+00:00 136309 ovpn-server[827]: 85.116.124.93:61510 Re-using SSL/TLS context
2026-03-25T10:30:25.052087+00:00 136309 ovpn-server[827]: 85.116.124.93:61510 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
2026-03-25T10:30:25.052199+00:00 136309 ovpn-server[827]: 85.116.124.93:61510 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
2026-03-25T10:30:25.052330+00:00 136309 ovpn-server[827]: 85.116.124.93:61510 LZO compression initializing
2026-03-25T10:30:25.052400+00:00 136309 ovpn-server[827]: 85.116.124.93:61510 Control Channel MTU parms [ mss_fix:0 max_frag:0 tun_mtu:1250 tun_max_mtu:0 headroom:126 payload:1600 tailroom:126 ET:0 ]
2026-03-25T10:30:25.052485+00:00 136309 ovpn-server[827]: 85.116.124.93:61510 Data Channel MTU parms [ mss_fix:0 max_frag:0 tun_mtu:1500 tun_max_mtu:1600 headroom:136 payload:1768 tailroom:562 ET:0 ]
2026-03-25T10:30:25.138033+00:00 136309 ovpn-server[827]: 85.116.124.93:61510 PID_ERR replay-window backtrack occurred [1] [TLS_WRAP-0] [0_0000_] 1774434624:7 1774434624:6 t=1774434625[0] r=[0,64,15,1,1] sl=[57,7,64,528]
2026-03-25T10:30:25.140040+00:00 136309 ovpn-server[827]: 85.116.124.93:61510 VERIFY OK: depth=1, CN=StenLi
2026-03-25T10:30:25.140161+00:00 136309 ovpn-server[827]: 85.116.124.93:61510 VERIFY OK: depth=0, CN=User_0_37
2026-03-25T10:30:25.140674+00:00 136309 ovpn-server[827]: 85.116.124.93:61510 peer info: IV_VER=3.11.3
2026-03-25T10:30:25.140941+00:00 136309 ovpn-server[827]: 85.116.124.93:61510 peer info: IV_PLAT=win
2026-03-25T10:30:25.141059+00:00 136309 ovpn-server[827]: 85.116.124.93:61510 peer info: IV_NCP=2
2026-03-25T10:30:25.141171+00:00 136309 ovpn-server[827]: 85.116.124.93:61510 peer info: IV_TCPNL=1
2026-03-25T10:30:25.141233+00:00 136309 ovpn-server[827]: 85.116.124.93:61510 peer info: IV_PROTO=8094
2026-03-25T10:30:25.141630+00:00 136309 ovpn-server[827]: 85.116.124.93:61510 peer info: IV_MTU=1600
2026-03-25T10:30:25.141690+00:00 136309 ovpn-server[827]: 85.116.124.93:61510 peer info: IV_CIPHERS=AES-128-CBC:AES-192-CBC:AES-256-CBC:AES-128-GCM:AES-192-GCM:AES-256-GCM:CHACHA20-POLY1305
2026-03-25T10:30:25.141751+00:00 136309 ovpn-server[827]: 85.116.124.93:61510 peer info: IV_LZO=1
2026-03-25T10:30:25.141805+00:00 136309 ovpn-server[827]: 85.116.124.93:61510 peer info: IV_AUTO_SESS=1
2026-03-25T10:30:25.141901+00:00 136309 ovpn-server[827]: 85.116.124.93:61510 peer info: IV_GUI_VER=OCWindows_3.8.0-4528
2026-03-25T10:30:25.141984+00:00 136309 ovpn-server[827]: 85.116.124.93:61510 peer info: IV_SSO=webauth,crtext
2026-03-25T10:30:25.142095+00:00 136309 ovpn-server[827]: 85.116.124.93:61510 TLS: move_session: dest=TM_ACTIVE src=TM_INITIAL reinit_src=1
2026-03-25T10:30:25.142147+00:00 136309 ovpn-server[827]: 85.116.124.93:61510 TLS: tls_multi_process: initial untrusted session promoted to trusted
2026-03-25T10:30:25.217911+00:00 136309 ovpn-server[827]: 85.116.124.93:61510 Control Channel: TLSv1.3, cipher TLSv1.3 TLS_AES_256_GCM_SHA384, peer certificate: 2048 bits RSA, signature: RSA-SHA256, peer temporary key: 253 bits X25519
2026-03-25T10:30:25.218088+00:00 136309 ovpn-server[827]: 85.116.124.93:61510 [User_0_37] Peer Connection Initiated with [AF_INET]85.116.124.93:61510
2026-03-25T10:30:25.218215+00:00 136309 ovpn-server[827]: 85.116.124.93:61510 PUSH: Received control message: 'PUSH_REQUEST'
2026-03-25T10:30:25.218319+00:00 136309 ovpn-server[827]: MULTI: new connection by client 'User_0_37' will cause previous active sessions by this client to be dropped.  Remember to use the --duplicate-cn option if you want multiple clients using the same certificate or username to concurrently connect.
2026-03-25T10:30:25.218507+00:00 136309 ovpn-server[827]: MULTI_sva: pool returned IPv4=10.0.0.2, IPv6=(Not enabled)
2026-03-25T10:30:25.218594+00:00 136309 ovpn-server[827]: OPTIONS IMPORT: reading client specific options from: /etc/openvpn/ccd/User_0_37
2026-03-25T10:30:25.218736+00:00 136309 ovpn-server[827]: MULTI: Learn: 10.0.0.37 -> User_0_37/85.116.124.93:61510
2026-03-25T10:30:25.218823+00:00 136309 ovpn-server[827]: MULTI: primary virtual IP for User_0_37/85.116.124.93:61510: 10.0.0.37
2026-03-25T10:30:25.218981+00:00 136309 ovpn-server[827]: Data Channel MTU parms [ mss_fix:1555 max_frag:0 tun_mtu:1500 tun_max_mtu:1600 headroom:136 payload:1768 tailroom:562 ET:0 ]
2026-03-25T10:30:25.219100+00:00 136309 ovpn-server[827]: Outgoing dynamic tls-crypt: Cipher 'AES-256-CTR' initialized with 256 bit key
2026-03-25T10:30:25.219228+00:00 136309 ovpn-server[827]: Outgoing dynamic tls-crypt: Using 256 bit message hash 'SHA256' for HMAC authentication
2026-03-25T10:30:25.219524+00:00 136309 ovpn-server[827]: Incoming dynamic tls-crypt: Cipher 'AES-256-CTR' initialized with 256 bit key
2026-03-25T10:30:25.219654+00:00 136309 ovpn-server[827]: Incoming dynamic tls-crypt: Using 256 bit message hash 'SHA256' for HMAC authentication
2026-03-25T10:30:25.219719+00:00 136309 ovpn-server[827]: Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
2026-03-25T10:30:25.219779+00:00 136309 ovpn-server[827]: Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
2026-03-25T10:30:25.219852+00:00 136309 ovpn-server[827]: SENT CONTROL [User_0_37]: 'PUSH_REPLY,redirect-gateway def1,dhcp-option DNS 8.8.8.8,route-gateway 10.0.0.1,topology subnet,ping 10,ping-restart 120,ifconfig 10.0.0.37 255.255.0.0,peer-id 1,cipher AES-256-GCM,protocol-flags cc-exit tls-ekm dyn-tls-crypt,tun-mtu 1500' (status=1)
2026-03-25T10:30:25.219932+00:00 136309 ovpn-server[827]: User_0_37/85.116.124.93:61510 PID_ERR replay-window backtrack occurred [2] [TLS_WRAP-0] [0__000000_] 1774434624:10 1774434624:8 t=1774434625[0] r=[0,64,15,2,1] sl=[54,10,64,528]
2026-03-25T10:30:26.384045+00:00 136309 ovpn-server[827]: User_0_37/85.116.124.93:61510 Data Channel: cipher 'AES-256-GCM', peer-id: 0, compression: 'lzo'
2026-03-25T10:30:26.384227+00:00 136309 ovpn-server[827]: User_0_37/85.116.124.93:61510 Timers: ping 10, ping-restart 240
2026-03-25T10:30:26.384267+00:00 136309 ovpn-server[827]: User_0_37/85.116.124.93:61510 Protocol options: protocol-flags cc-exit tls-ekm dyn-tls-crypt

← Установка chatmail relay для delta.chat
Ответ на: комментарий от Dimez

Хорошо, а как объяснить что когда я коннекчусь на этот серв с европейского ip этот локальный ip тоже не пингуется? Вот он законеекчен с ip 10.0.0.37

TITLE,OpenVPN 2.6.19 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] [DCO]
TIME,2026-03-25 16:25:32,1774455932
HEADER,CLIENT_LIST,Common Name,Real Address,Virtual Address,Virtual IPv6 Address,Bytes Received,Bytes Sent,Connected Since,
Connected Since (time_t),Username,Client ID,Peer ID,Data Channel Cipher
CLIENT_LIST,User_0_37,185.232.170.137:53140,10.0.0.37,,3625,4422,2026-03-25 16:25:23,1774455923,UNDEF,144075,0,AES-256-GCM
HEADER,ROUTING_TABLE,Virtual Address,Common Name,Real Address,Last Ref,Last Ref (time_t)
ROUTING_TABLE,10.0.0.37,User_0_37,185.232.170.137:53140,2026-03-25 16:25:30,1774455930
GLOBAL_STATS,Max bcast/mcast queue length,3
GLOBAL_STATS,dco_enabled,0
END

пингую:

root@136309:/var/log/openvpn# ping 10.0.0.37
PING 10.0.0.37 (10.0.0.37) 56(84) bytes of data.
^C
--- 10.0.0.37 ping statistics ---
20 packets transmitted, 0 received, 100% packet loss, time 19485ms
Gosu7
() автор топика

В глаза бросается «MULTI: new connection by client 'User_0_37' will cause previous active sessions by this client to be dropped. Remember to use the --duplicate-cn option if you want multiple clients using the same certificate or username to concurrently connect.»

anc ★★★★★
()

Зря айпи выложил, теперь товарищу майору будет легче найти запрещённые действия. И старый Ларавел желательно обновить на новый Yii 3 свежей версии после релиза.

anonymous
()
← Установка chatmail relay для delta.chat
Admin